I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?
My system uses the ext3 file system.
Thanks a lot!
I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?
My system uses the ext3 file system.
Thanks a lot!
Most Unix-like operating systems don't store the creation time of file or directories. You can get their modification time, last access time, and inode change time via the ls
and stat
commands.
But, there are some third party tools as we can see in other answers. And, FreeBSD seems to have that capability. See @Graham Perrin's comment here which goes to that answer.
Assuming that you are using ext4, you can see when a file was created. The ext4 file system stores this as crtime
.
You can get this information with the debugfs command.
Here is a script that you can run with superuser privileges to print the crtime of a file. (Note that it requires ruby and has a bug in the first line: #!/usr/bin/env ruby
)
debugfs -R 'stat ' file_name
Nov 11, 2011 at 13:09
crtime.ruby:47:in
<main>': undefined method first' for "/dev/sda5":String (NoMethodError)
.
stat
is recent enough to know about the creation time, but it shows a Birth: -
line for every file I throw at it ... :(
The brute force 'old school' way for ext3 is the "Tripwire" method (I named it from the insidious Tripwire product): build a list of files, then do it again, run diff. The more often you build your list and diff it, more close in time you will know when directories were both created AND deleted.
The two ways to build such a list is use: ls
or to use lsof
. You only need to save the diffs. If you know the user or the specific parent directory is not too large, then you can run it every second or more often (since sleep takes decimals) in a loop.